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Abstract — In any communication network, the maximum num- 
ber of link-disjoint paths between any pair of communicating 
nodes, S and T, is limited by the S-T minimum link-cut. 
Multipath routing protocols have been proposed in the literature 
to make use of these S-T paths in enhancing the survivability 
of the S-T information flow. This is usually accomplished by 
using a subset of these paths to forward redundant data units 
or combinations (if network coding is allowed) from S to T. 
Therefore, this enhancement in survivability reduces the useful 
S-T information rate. In this paper we present a new way to 
enhance the survivability of the S-T information flow without 
compromising the maximum achievable S-T information rate. 
To do this, bottleneck links (in the min-cut) should only forward 
useful information, and not redundant data units. We introduce 
the idea of extra source or destination connectivity with respect 
to a certain S-T max-flow, and then we study two problems: 
namely, pre-cut protection and post-cut protection. Although 
our objective in both problems is the same, where we aim to 
maximize the number of protected paths, our analysis shows that 
the nature of these two problems are very different, and that the 
pre-cut protection problem is much harder. Specifically, we prove 
the hardness of the pre-cut protection problem, formulate it as 
an integer linear program, and propose a heuristic approach to 
solve it. Simulations show that the performance of the heuristic 
is acceptable even on relatively large networks. In the post-cut 
problem we show that all the data units, forwarded by the min- 
cut edges not incident to T, can be post-cut-protected. 

I. Introduction 

The survivability of an information flow between two ter- 
minal nodes, S and T, can be enhanced by using part of the 
available network resources (bandwidth) to forward redundant 
information from S to T. Depending on the used survivability 
mechanism, the redundant information can be used to recover 
from data corruption if, for example, a Forward Error Cor- 
recting code (FEC) is used, or it can be used to recover 
from network component failures, if a proactive protection 
mechanism is used. In proactive protection, traditionally k 
edge-disjoint S-T paths are used to forward k copies of the 
same data unit from S to T, which guarantees the successful 
delivery of data if at most fc — 1 link failures occurred in the 
network. This is usually accomplished by means of a multipath 
routing protocol, such as MDVA [l] in wired networks or 
AOMDV ||2| in ad hoc wireless networks. The maximum 
number of edge-disjoint S-T paths is limited by the minimum 
S-T link-cut, which is defined as the smallest set of links that, 
when removed, all the S-T paths become disconnected. Let 
h denote the value of the S-T min-cut. Then, if we want to 
forward data units from S to T and protect them against q 
failures, we cannot send more than k = [^^J data units 
since q + 1 copies of each data unit should be forwarded. 

It is clear that traditional proactive protection approaches are 



very demanding and waste a lot of resources. Even if g = 1, 
at least 50% of the used network resources will be wasted to 
deliver the redundant information, which reduces the useful 
S-T information rate by at least 50%. Network coding 13] 
can be used to overcome this problem in traditional proactive 
protection schemes. The basic idea of network coding is that 
it allows intermediate network nodes to generate combinations 
from the original data units, instead of just forwarding them as 
is. Therefore, to recover k data units at the destination node T, 
k linearly independent combinations in the k data units should 
be delivered to T. That is, if we want to forward data units 
from S to T and protect them against q failures, we can send at 
most k = h — q data units. Note that this is done by designing 
a network code that creates k + q combinations at intermediate 
network nodes such that any k of them are solvable, which 
means that it is enough to receive only k combinations to 
recover the k data units at T. This simple analysis shows that 
the useful information rate of network coding-based protection 
is better than that of traditional protection approaches as long 
as h > q+1, which is usually the case. Examples of network 
coding -based protection can be found in |4|, |5l, f6l|, f7^. 

Network coding-based protection and traditional protection 
schemes, provide end-to-end protection of the whole S-T paths 
used to forward useful data from S to T. In these approaches, 
the more we enhance the S-T flow survivability, the more 
we reduce the useful S-T information rate. This is because 
such approaches treat all network links equally, i.e., bottleneck 
links (that belong to the min-cut) as well as non-bottlenecks 
are used to forward redundant data units or combinations. 
Usually, most of the links in a network are not bottleneck 
links, which means that link failures are more likely to affect 
non-bottleneck links than links in the min-cut. Therefore, we 
can enhance the survivability of the S-T information flow 
without reducing the useful S-T rate below the max-flow, if 
we provide protection to the non-bottleneck links only. We 
call this kind of protection Max-flow protection because the 
max-flow can still be achieved under these conditions as long 
as no hnk in the min-cut fails. Note that max-flow protection 
can be transparently combined with end-to-end protection if 
needed. In this paper, we focus our analysis on the problem of 
max-flow protection only, and we do not consider combining 
it with traditional protection schemes. To the best of our 
knowledge the problem of max-flow protection has not been 
studied before. 

The rest of this paper is organized as follows. Section HI] 
presents the terminology and definitions that will be used 
throughout the paper The problems of pre-cut and post-cut 
protection are presented in Section [III] In Section |IV] we 
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Study the pre-cut protection problem and prove its hardness. 
The problem of pre-cut protection is formulated as an Integer 
Linear Program (ILP) in Section [V] A 3-phase heuristic 
approach to solve the pre-cut protection problem is described 
in Section |VI] Section IVIII discusses the post-cut protection 
problem. Finally, Section IVIIII concludes the paper. 

II. Preliminaries 

We represent a network by a directed acyclic graph G=(V,E), 
where V is the set of network nodes and E is the set of 
available links, where each link is assumed to have unit 
capacity. The network has a source node (S) that wants 
to send data to a destination (T), where the S-T max-flow 
is assumed to be h. We assume that a multipath routing 
protocol is used, e.g., lH] or ||2l, and the source is fully 
utilizing the available connectivity by sending h data units 
to the destination simultaneously. To simplify the analysis, 
we assume that the network has a single cut. In the rest of 
this section we define the meaning of extra connectivity with 
respect to the S-T max-flow. After that we discuss some of 
the properties of nodes with extra connectivity. 

A. Terminology 

Let/('^)(B) denote the max-flow from the nodes in set A to 
the nodes in set B on a directed graph, which can be calculated 
by computing the max-flow between a virtual source/sink pair, 
such that the virtual source is connected to the nodes in A with 
infinite capacity edges and the virtual sink is connected to the 
nodes in B with infinite capacity edges also. Let h = f^{T) 
be the S-T max-flow. We define the following: 

1) A node with Extra Source Connectivity (wESC) is a 
node, u, that satisfies the following conditions: 

. /^(m,T) > h, and /(s.«)(T) = h. 

2) A node with Extra Destination Connectivity (wEDC) is 
a node, v, that satisfies the following conditions: 

. /^(w,T) = h, and (T) > h. 

3) A node with No Extra Connectivity (wNEC) has: 

. /^(«,T)=/(^.-)(T) = /i. 
Of course, a node with both extra source and extra desti- 
nation connectivity cannot exist, because this contradicts the 
assumption that the max-flow equals h. Consider the graph 
G in Figure [3] The S-T max-flow in G is 4, which implies 
that four data units can be forwarded from S to T on four 
link-disjoint paths. Assume we found the following paths. 
Pi = {S^A^E^J^T} that forwards data unit 
w, P2 = {S ^ B ^ F ^ G ^ T} that forwards data 
unit X, P3 ^ {S ^ F ^ H ^ T} that forwards data 
unit y, and P4, = {S ^ D ^ I ^ T} that forwards data 
unit z. Each path Pi contains a cutting edge Ci, which , if 
deleted, will result in reducing the max-flow by exactly 1 
unit of flow because path Pi will be disconnected and cannot 
be reestablished in any way. In our example. Pi contains 
Ci = {(J,T)}, P2 contains C2 = {(G,T)}, P3 contains 
C3 = {{F,H)}, and P4 contains C4 = {{I,T)}. Note that 
the min-cut may not always be unique, but in this paper we 
assume that the graph under consideration has only one cut. 



B. Properties of nodes wESC/wEDC 

Consider a path that contains a node, u, wESC and a node, 
V, wEDC. Note that node u must be closer (in number of hops 
on the path) to the source than v, otherwise the max-flow 
assumption will be contradicted, as shown in Figure [U 




Fig. 1. In (a) we can say that the S-T max-flow is I and that u is a node 
wESC and v is a node wEDC. However, this is not true in (b), because if 
there are two edge-disjoint paths {5 — > m — > T} and {S — » f — > T}, i.e., 
u is not a node wESC and v is not a node wEDC 

In general, removing the min-cut edges (i.e., the edges in 
Ui^iCi) partitions the network into two partitions A and A', 
such that S e A md T e A'. Note that, after deleting the 
min-cut edges, each of the partitions A and A' is a connected 
component (at least weakly), and that partition A contains 
nodes wESC, but partition A' contains nodes wEDC. 

Lemma 1. Any node u £ A, u ^ S is a node wESC. 

Proof: We prove this by contradiction. Let u £ A,u ^ S, 
but u is not a node wESC. Then, f^{u, T) — h, which means 
that node u cannot receive additional flow from S if the S- 
T max-flow is established. This impUes that either node u is 
behind the min-cut (i.e., u E A'), which contradicts the starting 
assumptions, or that there is another min-cut between S and 
u, which contradicts the single min-cut assumption. ■ 
In a similar fashion, we can prove the following for any 
node V € A',v j^T. 

Lemma 2. Any node v £ A' , v ^ T is a node wEDC. 

In our following discussion we refer to A as the pre-cut 
portion of the network, and to A' as the post-cut portion of 
the network. Figure |2] summarizes the previous discussion. 




Fig. 2. Nodes wESC, wNEC and wEDC with respect to min-cuts 

III. Problem description 

The cutting-edges, cannot be protected unless we trade 
bandwidth for survivability (i.e., unless we use an S-T path to 
carry redundant information to the destination), which reduces 
the useful S-T information rate. This tradeoff not only protects 
the cutting-edges, but also protects any edge carrying data in 
the network. However, the non-cutting-edges (or a subset of 
them) can be protected without reducing the S-T information 
rate, if the graph contains nodes wESC and/or wEDC. For 
example, nodes E, F, I and J in Figure [3] are nodes wESC, 
and node H is a node wEDC. There are four possible ways 
to utilize the extra source connectivity in Figure [3j 1) protect 
data units x and y by sending x + y to F through C, 2) protect 
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w by sending a duplicate to E through C and F, 3) protect w 
by sending a duplicate to J through C, F, E and G 4) protect z 
by sending a duplicate to I through C and F. The first option 
is better than the other three since sending x + y toF enhances 
the chances of two data units (x and y) to reach T, compared 
to duplicating w or z alone, which protects a single data unit 
only. Figure |4] shows the first option, and it also shows how to 
utilize the extra destination connectivity from node H, where 
H sends a duplicate of y to T through node K. 




Fig. 3. Graph G with Fig. 4. Utilizing extra 

S-T max-flow = 4 connectivity 



In this work, we propose a different way to handle the 
"survivability vs. bandwidth" trade-off. We propose a new 
approach to provide protection to the S-T information flow 
without reducing the useful S-T data rate. Basically, we avoid 
protecting the bottlenecks in the network (the min-cut links), 
and we try to efficiently utilize (by using network coding if 
possible) the available network connectivity before and/or after 
the bottleneck to provide protection to the non-min-cut links 
in the graph. We divide the problem into two sub-problems as 
follows: 

1) Pre-cut protection: Our objective is to maximize the 
number of pre-cut-protected S-T paths. We show that 
this problem is NP-hard, and we provide a heuristic 
to solve it. To evaluate our heuristic we compare its 
performance to an ILP. 

2) Post-cut protection: Similar to the previous objective, we 
aim to maximize the number of post-cut-protected S-T 
paths. Let be the closest cutting edge to the destination 
T on path Pi. We show that all the paths that do not have 
T as the head node of Ci , where 1 < i < h, can be post- 
cut-protected together against at least one failure. 

IV. Pre-Cut: Nodes with Extra Source 
Connectivity 

As discussed in Section|lIl all nodes wESC are located in the 
pre-cut portion of the network. Assume that the set X contains 
all the nodes wESC, X = A\S = {ui,U2, ■ ■ ■ ,u\x\}- Then, 
the following is true: 

\x\ 

iJ2 f{n^, T))-\X\f{T) > f{uuu2, u\x\,T)-f{T) 

i=l 

(1) 

This is because the extra source connectivity may be shared 
between the nodes in X. Therefore, the right hand side of the 
inequality is what really determines the available extra source 
connectivity (ESC). This implies that not all nodes wESC in X 



can receive redundant flows from S to be used to protect the S- 
T max-flow, and thus, a subset X X should be intelligently 
selected to receive the available extra source flow and utilize 
it in the best way possible. Note that the number of nodes in 
X cannot exceed the extra available connectivity, i.e.: 

ESC = f{u^,U2, . . . , u\x\,T) - f{T) > \X\ (2) 

The selection of X depends on how the S-T max-flow is 
routed on the graph. Consider the graph in Figures |5(a)| and 
|5(b)| the S-T max-flow in this network is 2, and there is only 
one S-T min-cut in the graph, which contains the edges (A,T) 
and (C,T). Nodes A, B and C are nodes wESC, and the total 
available extra source connectivity equals f^{A,B,C,T) — 
f^{T) = 4 — 2 — 2. Assume that the max-flow is routed as 
shown in Figure |5(a)| (the dashed lines), in this case Xi = 
{B,C} since the extra source connectivity is consumed by B 
and C. Moreover, note that only the path forwarding b can be 
pre-cut-protected by sending copies of b on (5*, B) and {S, C). 
Now consider the routing shown in Figure |5(b)| in this case 
X2 = {A, C}. Unlike the previous case, both paths can be 
pre-cut-protected by sending a second copy of a to A, and 
a second copy of b to C through B. Obviously, the second 
routing option is better since it allows the protection of both 
paths (equivalently both data units), in this sense we say X2 
is better than Xi. 




(a) (b) 

Fig. 5. Routing the max-flow is what determines X. In (a) X = {B, C}, 
and one path is protected. In (b) X = {A, C}, and both paths are protected. 

It was shown in the previous example that routing the 
max-flow and selecting X are inseparable problems, and that 
routing the S-T max-flow corresponds to selecting X. Let us 
define the extra source connectivity to a node u with respect 
to the routing of the S-T max-flow in the network as: 
EC{u) = f^{u,T)-f^{T) 

We say that an S-T path is pre-cut-protected if a segment of 
this path in the pre-cut portion of the network is protected. 
That is, a path is pre-cut-protected if it contains a node wESC 
with respect to the routing of the S-T max-flow. Therefore, 
maximizing the number of pre-cut-protected paths means 
maximizing the number of paths containing nodes wESC. 

For large networks, trying-out all possible routing choices 
to find the best one that will maximize the number of paths 
containing nodes wESC is computationally expensive. The 
following theorem proves that this problem is in fact an 
NP-hard problem. The full-proof is omitted due to space 
limitations, and only a sketch of the proof is provided. 
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Theorem 1. Routing the S-T max-flow to maximize the number 
of S-T paths containing nodes wESC is NP-hard. 

Proof: To prove this theorem, we reduce the Maximum 
Coverage problem with Group budget constraints (MCG) [8J 
to our problem. In the MCG problem, we have a collection 
of sets C = {Ci, C2, Cm} that are not necessarily disjoint, 
where each set is a subset of a given ground set H. In addition, 
C is partitioned into disjoint groups {Gi, G2, G„}, where 
each Gj consists of a group of sets in C. The problem asks 
to select k sets from C to maximize the cardinality of their 
union, such that at most one set from each group is selected. 
Note that the cover size in the MCG problem is limited by 
the group budget constraints, and that the number of paths 
containing nodes wESC is Umited by the available extra source 
connectivity in our problem. To prove the theorem we reduce 
any instance of the MCG problem to a directed graph with 
a single cut that translates the group budget constraints into 
constraints on the available extra source connectivity (similar 
to the one in Figure |6]l. It is now easy to prove that solving 
the MCG problem solves our problem and vice versa. 




Fig. 6. Graph resulting from reduction 



Note that if network coding was not allowed, then from 
equation ^ we cannot protect more than ESC data units. 
Therefore, to utilize the extra source connectivity in a more 
efficient manner we should apply network coding whenever 
possible. Network coding can be used if a node wESC, say 
u, lies on more than one S-T path, and has EC{u) > 1. For 
example, let u be a node wESC that lies on two S-T paths, 
and that has EC{u) = 1. A network code can be designed 
to deliver three combinations in two data units to u, such 
that any two combinations are solvable, i.e., two data units 
are protected from S to it against a single link failure. Note 
that the number of failures that can be tolerated is at most 
EC{u). Therefore, the nodes in X should have the following 
properties: 

1) Each node m & X must have f^{u,) > /"'(T). 

2) The combinations received by a node Ui E X must 
be solvable if at most e = f^{ui) — f^'''{T) failures 
occurred on the f^{ui) paths from S to Ui. 

The first condition requires the flow from the source to 
each node Ui G X to be larger than the flow from that node 
to the destination. This condition is necessary to introduce 
redundancy in the forwarding process from S to the nodes 
in X. The second condition can be satisfied by designing a 
network code that delivers, for each node Ui, a set of f^{ui) 
combinations, such that any (T) combinations of them are 



solvable. These two conditions allow a node Ui to act as pre- 
cut decoding node, which can recover the data units sent from 
S to T through Ui, if at most e — f^{ui) — f"^{T) failures 
occurred on the S-Ui link-disjoint paths, and then send these 
native data units to T. 

In the next section we present an integer linear program 
(ILP) formulation of our problem. Solving the ILP will select 
the routes for the S-T max-flow, and will maximize the number 
of pre-cut-protected paths (the number of S-T paths containing 
nodes wESC). 

V. Integer Linear program Formulation 

We need to maximize the number of S-T paths that contain 
nodes wESC, regardless of the number of those nodes. We 
assume that the S-T max-flow equals h, and that the flow can 
take integer values only. Since we are interested in the number 
of paths containing nodes wESC, we treat each of the h units 
of flow as a commodity. That is, we have h commodities, each 
of which is responsible for selecting a single S-T path. The ILP 
find the routes for these h commodities on a graph with unit- 
capacity links, such that the number of paths containing nodes 
wESC is maximized. Let us begin by defining our notation: 

« Let (Ji be a binary variable that equals 1 if path i (Pi) 
goes through at least one node wESC, and otherwise. 
That is, (Ti = 1 if Pi is pre-cut-protected, and otherwise. 

• /(a b) value of the flow from commodity i on link 
(a,b). The links forwarding /* determines Pi. 

« Uj is the amount of flow /* entering node j. Although 
Uj is not constrained to be binary, it will be either 1 or 
since the source sends only one unit of flow 

• 9{a b) '■^^ amount of extra flow that is sent from 
the source to node j on link (a,b). A node that consumes 
(not forwards) this flow will be included in X. 

m Xj is the amount of flow entering node j. Although 
Xj is not constrained to be binary, it will be either 1 or 
since the source sends only one unit of flow g*. 

• Q is a binary variable that equals 1 if node j is on Pi 
and is wESC, i.e., Q = UjXj. 

m dj is the minimum hop distance of node j from the source, 
which is a constant that can be computed for each node 
before solving the ILP, e.g., using Dijkstra's shortest path 
algorithm. 

> Sj is a variable that equals dj if Q — 1^ i-e., 5j = djQ- 

• J7 is a very large positive constant. 

• It; is a weighing factor for ^ ai, and is larger than the 
length of the longest possible path from the source to any 
node in the network, and can be set to \E\. This way the 
ILP maximizes the length of the protected paths if it does 
not reduce the number of protected data units. 

our objective function is: 

h 

Maximize w Ui + 6j (3) 

z=l Vi 

Subject to. 
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/(g ,,) = 1, Vi, where 1 <i < h (4) 

V(S,fc)GB 

E fkb) E /(M) - 0, Vz, V5 e T} (5) 

V(a,b)G-B V(h,a)e£; 

"5- E /(a,,)=0-Vz,j (6) 

V{a,j)eE 

E 5^5,6) <l'Vj (7) 
y{s.b)eE 

E 5/,,,)-0, (8) 
E E 5^ -0, Vi;en{^,i} (9) 

V{k,v)eE V{v,k)eE 

E5?a,6)+E/(U)<1' V(a,6)ei? (10) 

Vj Vi 

g-^Y^<o, vz,j (11) 



_ ^^12^ < 1 (12) 



'5}-rf,g = (13) 

Constraint (HI forces the S-T flow to be h, and constraint 
^ conserves all commodities on all nodes except S and T. (|6]l 
make = 1 if node j is on path i. The extra flow that can be 
sent to a node wESC is bounded by 1 as shown in constraint 
(|7]i. Constraint (O sets Xj to 1 if node j receives any extra flow. 
The extra flow (g^) is conserved at all nodes except the source 
and node j by constraint Constraint ( fTOl i guarantees that 
the link capacity of unit of flow is not exceeded. Constraint 
( fTTT i sets Q to 1 if node j is on path Pi and is a node wESC. 
Constraint ( fT2] i prevents tXi from being 1 if Pi has no node 
wESC. The value of 5] is set to dj if Q = 1 by constraint 
( |T3] l. Note that forcing the extra flow sent to node j to be 
at most 1 does not affect the ILP optimality, since a path is 
considered pre-cut-protected if it has a node wESC regardless 
of the amount of extra flow received at that node. 

In the next section we present a heuristic approach to solve 
the problem of maximizing the number of paths containing 
nodes wESC. Moreover, we compare the heuristic results to 
the results from the ILP. 



VI. Heuristic approach 

Our heuristic works in three phases; the first one greedily 
selects an initial set X'; the second one modifies the flow 
on the graph (if needed) to guarantee that the S-T max- 
flow is achieved, and the third one utilizes any remaining 
connectivity and produces the final set X. The first phase 
works in iterations, where a single node is added to X' in 
each iteration. Each time we add the node that can send the 
most flow to the destination, while being able to receive more 
flow from the source, to satisfy the two conditions stated at the 
end of Section |IV] If no more nodes satisfy this criteria and 
the S-T flow is still less than h, the second phase is entered. 
The second phase finds as much augmenting paths as possible 
from S to T so that the S-T max-flow is maximized. Finally, 
the third phase checks the nodes in the pre-cut portion of the 
graph to see if there are any remaining nodes wESC, and 
makes use of this extra connectivity. 

A. Phase 1: Selecting the initial set X' 

Recall that if all the min-cut edges are deleted, then the 
graph will be divided into two partitions A (pre-cut), and A' 
(post-cut). Note that the routing of the S-T flow in the post-cut 
portion of the network is independent from the routing of the 
S-T flow in the pre-cut portion of the network. Therefore, and 
since the selection of the final set X depends on the routing 
of the S-T max-flow in the pre-cut portion of the graph, we 
can simplify the graph under consideration and just focus on 
the sub-graph, H, induced by the nodes in A with a little 
modification. Specifically, given a directed graph G(Vg, Eq), 
let t{u,v) represent the tail node of edge (u,v), i.e., node u. 
Also, let Fs be the set of tail nodes on the min-cut edges,i.e., 
Fs contains the nodes in: 

h 

1=1 

where the S-T max-flow = h, and C; is the cutting edge 
on path i as defined in Section [III We transform graph G 
to H{Vh,Eh) as follows: 

1) Delete the nodes in {Vg\A} 

2) Vh = {A, T'}, where T' is a dummy destination node. 

3) Eh = {iu,v)\u,ve A}[j{{u,T')\yu G Fs}. Note that 
{S,Fs}cA. 

Each iteration of phase 1 adds the node that can send the 
most flow to T (or equivalently T'), while being able to receive 
more flow from the source. Let this node be x, then it satisfies 
the following conditions: 

1) r{T')>riT'),yuevH 

2) fix) > nr) 

After identifying node x, the flow is sent in two steps; in 
the first step, {f^{T') + 1) units of flow are sent from S to x, 
and in the second one f^{T') units of flow are sent from x 
to T'. This way, node x can receive redundant information to 
protect the f^{T) path segment from S to x. Only one extra 
unit of flow is sent to x so that the extra source connectivity is 
fairly divided between the nodes in X' at the end of phase 1. 
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From a network flows perspective, to forward the flow as 
described in the previous paragraph, (/^(T') + 1) units of 
flow should be sent on (/^(T') + 1) augmenting paths from 
S to X, and /^(T') units of flow should be sent on /""(T') 
augmenting paths from x to T'. Note that since we are working 
on a residual graph, the paths found from x to T' may contain 
backward edges, which were used initially to forward flow 
from S to X. If this happens then the flow sent from S to the 
nodes in X' may be changed and some nodes in X' may not 
still be nodes wESC. To resolve this issue, we can delete all 
the edges on the paths found from S to a; in each iteration. 
However, this may reduce our ability to find augmenting paths 
from S to the nodes in H, and thus, may reduce the number 
of nodes that can be added to X'. Therefore, to be able to find 
augmenting paths without causing any of these problems we 
work with two copies of H. The first one, which we call H^, 
is used to find paths from S to the nodes in H, and the second 
one, which we refer to as H^, is used to find paths from the 
nodes in H to T'. The links in and are related to 
each other as follows: 

• After the first step is done, and {f^{T') + 1) paths were 
found from S to a; and augmented on . Every edge 
(u, v) in E^T that corresponds to a backward edge (v, 
u) in E[js is deleted. 

• Similarly, after the second step is completed, and f^{T') 
paths were found from x to T' and augmented on . 
Every edge (u, v) in E^s that corresponds to a backward 
edge (v, u) in E^t is deleted. 

In an iteration, if two or more candidate nodes have the same 
flow to T', the tie is broken in favor of the largest minimum 
hop distance from the source, i.e., the one with the largest 
d^{u) is chosen to be added to X'. After that, if two or more 
nodes have the same flow and minimum hop distance a node 
is chosen randomly. Taking this into consideration, phase 1 
ends when no more nodes can be added to X'. 

B. Phase 2: Maximizing the S-T flow 

The resulting S-T flow from phase 1 equals 
XlvrcsX' /^(-^')' which might be less than or equal to 
h (the max-flow). This is because the extra available 
connectivity is shared between the nodes in Vh- For 
example, consider the graph in Figure |7(a)[ where the S-T 
max-flow is 2. Phase 1 resulted in adding only one node 
(F) to X' . Assume that node F receives two units of flow 
from S along the two paths Pi — {S C ~* F} and 
P2 = {S^B—fA^D^E—f F}, and sends one unit 
of flow to T on the direct edge (F, T). The resulting residual 
graph after augmenting these paths is shown in Figure |7(b)[ 
where the backward edges resulting from the augmentation 
process are shown in boldface. At this point, no more nodes 
wESC can be added to X' (because the two conditions in 
the previous subsection are not met for any node), but the 
S-T flow so far is only equal to 1. Therefore, phase 2 should 
be entered to maximize the S-T flow. Assume that phase 2 
found the path P^i ^ {S ^ A ^ B ^ E -> D ^ T}, and 
augmented the flow. After this step, no more S-T paths can 



be found on the residual graph, which means that the S-T 
flow is maximized, the resulting residual graph is shown in 
Figure |7(c)| Note that after phase 2, node F still has two 
link-disjoint paths from S. 




(a) Graph H with 
S-T max-flow = 2 



(b) Residual graph 
after phase 1 



(c) Residual graph 
after phase2 



Fig. 7. The operation of the first two phases, (b) node F is added to X' , 
and it receives two units of flow from S and send one unit of flow to T. (c) 
The S-T max-flow is maximized 



C. Phase 3: Utilizing the remaining ESC 

This phase simply checks if it is possible to send extra flow 
to any node in H (that lies on at least one path) after the 
first two phases are finished. If a node u is found to be able 
to receive extra flow e' from S, then if it is not already in 
X' it should be added to X' . The number of data units node 
u sends to T' equals /"(T'). The number of data units or 
combinations it can receive from S is fc = f '"'{T') + e' if it is 
not in X', and is fc = /"(T') + e' + 1 if it is already in X' . 
If f'^{T') = 1 no coding is needed and we need to just send 
copies of the same forwarded data unit on all the paths to u. 
However, if f^''{T') > 1 a network code should be designed 
to deliver fc combinations to u such that any f^{T) of them 
are solvable. Algorithm [T] summarizes the three phases. 

D. Evaluation 

In this section we compare the results from our heuristic to 
the results from the ILP presented in Section |Vl The heuristic 
was compared to the ILP in five different cases. Each case rep- 
resents a different network size, where the number of network 
nodes V was changed to take the values {5, 10, 15, 20, 25}. In 
each case eighty random network instances were generated, 
and fed to the heuristic and the ILP. Figure [8] shows the ratio 
between the average number of protected paths by the heuristic 
and the average number of protected paths by the ILP for the 
eighty runs. The figure shows that the performance of our 
heuristic is acceptable, where in the worst case at V" = 20 it 
was around 77% of the optimal on average. 
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Fig. 8. Ratio of the number of protected paths by the heuristic to that of the 
ILP for different number of nodes 
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Algorithm 1 Selecting set X 

Input: Graph H{Vh,Eh), h = S-T max-flow 
Output: Set X containing nodes wESC 
1: X' = STJlow = 0, Phase_done = 
2: Create matrices FIows[Vh], FIowt[Vh] //One dimensional 
matrices initialized to all zeros, to store the final flow from S to 
each node in X, and from each node in X toT' . This information 
will be used for coding later 
3: //Phase 1 

4: Create graphs and H^, where V^s = V^t — Vh and 

Eus — EffT = 
5: while {Phase_done =— 0) do 
6: Compute /"^(li) on graph H^, Vu £ Vjjs 
1: Compute /"(T') on graph Vm G Vht 
8: Select node x, where r{T') > P(T'),\/u G Vh, and 

/^(x) > r(r') 

9: if (No such node exists) then 

10: Phaae_done — 1 

1 1 : else 

12: Find f {T') + 1 augmenting paths from S to a:: on 

13: Delete all forward edges in i/^ if they are reversed in 

H^//due to augmentation 

14: Find /""(T') augmenting paths from x to T' 

15: Delete all forward edges in if the are reversed in H 

16: X' ^X'U {x} 

17: STJlow = STJlow + /"^ (T') 

18: FZouJsH = ,r(T') + 1 

19: FIowt[x\ = r\T') 

20: end if 

21: end while 

22: for ah ({u, v) G Eh) do 

23: it ({v,u) £ Eus\\{v,u) e Eut) t\itn 

24: Reverse (u, v) in // 

25: end if 

26: end for 

27: Phase_done — //End of Phase 1, and beginning of Phase 2 

28: while (Phase_done =— 0) do 

29: if (STJlow = h) then 

30: Phase_done = 1 

31: else 

32: Find an S-T' augmenting path in H 

33: STJlow + + 

34: end if 

35: end while 

36: Phase_done — //End of Phase 2, and beginning of Phase 3 

37: for all (u G Vh) do 

38: Compute p = {u) on the current residual graph of H 

39: if (/^(m) > 0) then 

40: Find p augmenting paths from S to it on H 

41: Flows[u] — Flows[u] +p 

42: end if 

43: if (u ^ X') then 

44: Compute q — f"'^ (u) on 

45: FIowt[u] — FIowt[u] + q 

46: X' ^X'U {u} 

47: end if 

48: end for 

49: return X' 



To gain a better insight on the operation of the heuristic 
compared to the ILP we measured the S-T max-flow, counted 
the number of pre-cut-protected paths from the heuristic, and 
the number of pre-cut-protected paths resulting from the ILP 
in each time the heuristic and the ILP were executed (on the 
same network instance). 



The histograms for the cases of V = 10, 15, 20, and 25 
are shown in Figures [9(a)[ |9(b)[ |9(c)[ and |9(d)| respectively. In 
general, the results from the heuristic are close to those from 
the ILP. Note that in some cases, the number of times the 
heuristic is able to protect Xi paths may be larger than the 
number of times the ILP is able to protect the same number 
of paths Xi. However, this does not invalidate the heuristic 
because it comes at the price of protecting a larger number 
of paths X2 > Xi a fewer number of times. For example, in 
Figure |9(c)| the heuristic was able to protect Xi — 2 paths 
more than the ILP, but the ILP was able to protect X2 = 4 
paths more than the heuristic. 

E. Coding 

The resulting S-T' flow from the heuristic (or the ILP) can 
be decomposed into two parts; the first, a one-to-many flow 
from S to the nodes in X, and the second is a many-to-one 
flow from S and the nodes in X to T'. The many-to-one flow 
is not and cannot be coded, since it is composed from the h 
native data units that are forwarded from S and the nodes 
in X (possibly after decoding) to T', on h disjoint paths. 
However, the one-to-many flow from S to the nodes in X can, 
and should be coded to utilize the extra source connectivity 
in the most efficient manner. Note that this one-to-many flow 
is different from normal multicast flow since different data is 
sent to different nodes. Therefore, a standard multicast network 
code cannot be used. In fact, the coding in our case is simpler, 
and needs to be done at a limited number of network nodes 
as we will show in the following discussion. 

After the heuristic is done and the flow is constructed in 
the pre-cut portion of the graph. A node u & X can receive 
k + e = Flowsiu] units of flow from S and can send k = 
FIowt [u] units of flow to T' (these values were computed in 
the heuristic). This implies that there are fc + e edge-disjoint 
paths from S to u, and k edge disjoint paths from u to T' 
(or equivalently to T). Note that k represents the number of 
S-T paths (or data units) going through node u, and that e 
represents the paths used to carry redundant information to u. 

Let be the set of 1-hop neighbors of the source on all 
the k + e paths from S to Xi. Assume that all the nodes in 
have received the same set of k data units from the source 
(the k data units on the k S-T paths). To construct a network 
code that delivers k + e combinations to Xi such that any k 
of them are solvable using the received data units, we need 
to assign the proper coding vectors to the nodes in N^^ ■ The 
coding vectors can be assigned from an fc x (fc + e) matrix that 
has no singular fc x fc submatrices, i.e., any fc x fc submatrix is 
invertible. A class of matrices that satisfies this requirement is 
the Cauchy matrices Ig). Therefore, we can simply assign to 
each node in Nx. a column from a fc x (fc + e) Cauchy matrix, 
such that no two nodes are assigned the same column. 

However, such a coding scheme requires decoding at the 
nodes in X in each transmission round. An alternative way 
that will require a fewer number of decoding operations would 
be to use a systematic code. In a systematic code, fc out of the 
fc + e combinations will be trivial combinations, where each 
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(a) (b) (c) (d) 

Fig. 9. All figures are histograms, which count three different frequencies: the max-flow, the number of protected paths from the heuristic and the number 
of protected paths from the ILP. (a) has V = 10, (b) has V = 15, (c) has V = 20 and (d) has V = 25. The x axis is the number paths either protected or 
counted in the max-flow, and the y axis is the number of times each number of paths occurred as a max-flow or protected by the ILP or the Heuristic 



of which carries one of the k native data units. In this case, 
decoding is necessary at a node Xi G X, only if one of the 
native data units was lost due to a failure on one of the k 
S-T paths going through node Xi. A simple way to do this 
is presented in ifTol . Basically, let A4i denote a fc x (fc + e) 
Cauchy matrix with columns representing the coding vectors 
of the nodes in N^^- We can view A4i as two side-by-side 
matrices Mi = (A^fcJA^eJ, where Aiki is a fc x fc matrix , 
and Aid is a fc x e matrix. Let AA'^ be the fc x (fc + e) matrix 
resulting from multiplying by Mi: 

^ ^k- X -M. = ih\M^' X Me,) = {h\M'J = 
"1 •■■ a'gj^ ... a'„,k+e-i 
1 •■■ a[j^ ... ai,fe+e-i 

.0 • ■ • 1 "fc-i,fc ■ ■ • afc-i,fc+e-i . 

Since the original matrix Mi has no singular submatrices, 
then the resulting matrix M'i has no singular submatrices also. 
Note that although the non-singularity property is preserved, 
the matrix is no longer a Cauchy matrix. Therefore, given 
that the source has already transmitted the fc data units to the 
nodes in N^^, assigning the columns of M'i to the nodes in 
will create fc + e combinations such that any fc of them 
are solvable. Moreover, the code is systematic, where out of 
the fc + e combinations there are fc trivial combinations, each 
of which is composed of a single native data unit. 

A special case is when e ~ 1. In this case, after the source 
finishes transmitting the fc data units to the nodes in A^^,. 
(where \Nx.\ — fc + 1), one of the nodes in N^. can sum 
all the received data units and send this sum along with the fc 
native data units on fc + 1 paths to Xi. 

VII. Post-Cut: Nodes with Extra Destination 
Connectivity 

Nodes with extra destination connectivity (wEDC) can be 
found in the post-cut portion of the network only. Nodes 
wEDC (or a subset of them) can act as post-cut encoding 
nodes, which create and send redundant combinations to 
the destination node T to enhance the survivability of the 
information flow. Note that this case is different from the 
one considered previously, because all the nodes wEDC are 



sending their data units to the same destination. Let hd{u, v) 
denote the head node of edge {u, v), and let Ft be the closest 
set of nodes wEDC to S, or equivalently the farthest set of 
node wEDC from T, then Ft contains the nodes in: 

h 

U hd{a) 

4=1 

where Ci is the cutting edge on path Pi. Note that if an edge 
Ci has T as a head node, then T G Ft, which means that the 
data unit on the cutting edge Ci is delivered to the destination 
directly after the cut and cannot be protected. That is, the flow 
that can be protected from the nodes in Ft is reduced by the 
number of edges in the cut incident to T. Let F^ — Ft\T, 
note that < \Ft\ < h (Q when all the nodes in Ft are 
direct neighbors to T, and h when none of them is a direct 
neighbor to T), where h — f^{T). Also, note that since the 
nodes in Fl^ are the head nodes of edges in the min-cut, then 
we have f^{F^) — That is, each node in F/p has only 
one data unit to forward to T, and \F^\ is the maximum post- 
cut flow that can be protected. Let e denote the total available 
extra destination connectivity from the nodes in F^, then e is 
calculated as follows 

e^rHT)~\Ffr\. 
Note that if F^ ^ 0, then e > 1. If network coding is not 
allowed, then no more than e data units can be protected. 
However, if network coding is allowed, we prove that all the 
data units in F'rj. can be protected against at least a single 
failure: 

Theorem 2. Let F!j. be the set of head nodes of the closest 
min-cut edges to T, such that T ^ F^. Then if network coding 
is allowed, the data units at the nodes in F^ can be protected 
together against a single failure. 

Proof It was shown in [SJ that a many-to-one flow, 
similar to the flow from F^ to T, can be protected against 
a single link failure (using network coding) if and only if any 
subset of fc source nodes can reach the common destination 
node through at least fc + 1 edge-disjoint paths. 

Therefore, to prove the theorem we need to prove that any 
fc nodes in F/p can reach T through at least fc + 1 edge-disjoint 
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paths. We prove this by contradiction. Assume that there is a 
set, Q, of k nodes in F!p that can reach T through only k edge- 
disjoint paths, i.e., f'^{T) = k. Then there are k cutting edges 
on the k paths from the nodes in Q to T, which contradicts 
the assumption of the single min-cut. Therefore, any k nodes 
in F!p must be able to reach the destination node T through at 
least fc + 1 link disjoint paths, which concludes the proof. ■ 

If e = 1 we can use the coding tree approach presented in 
lis). However, if e > 1, then to be able to recover the \F!j,\ data 
units if at most e failures occurred in the post-cut portion of 
the graph, we need two conditions to be satisfied. First, any 
set of k nodes in F!p must be able to reach the destination 
through at least fc + e link-disjoint paths. Second, we need to 
assign coding vectors to the f^T(T) combinations such that 
any \F^\ vectors from them are linearly independent. Note 
that if e > 1, then the linear independence of any vectors 
does not necessarily mean that we can recover the \F^\ data 
units from any \F^\ combinations. This is because, when e 
is larger than 1, the first condition is not necessarily satisfied. 
To clarify this issue, consider the example in Figure [TO] In 
the figure, F^ = {A, B, C, D}, f^^{T) = 6 and e = 2. The 
black nodes represent the 6 paths from Fl^ to T, and Ci is the 
combination carried on Pi. The links represent the ability of 
the nodes in Flj, to reach the different paths. If a path Pi can 
be reached by fc nodes in F!p then is a function of fc data 
units. Note that since e ~ 2, the first condition stated above 
is not satisfied, because nodes C and D can reach T through 
only three paths not four. To satisfy the second condition, the 
coding vectors can be chosen as the columns of a 4 x 6 Cauchy 
matrix. Now consider the four combinations {ci, C2, C3, C4}. 
Since ci, C2 and C3 are functions of only two data units 
A and B (i.e., the coefficients of C and D are zeros), then 
the three combinations are linearly dependent. However, note 
that any two combinations of them are linearly independent, 
because in a Cauchy matrix any square submatrix has full rank 
(since it is another Cauchy matrix). That is, although the four 
combinations are in four data units (because of C4), only three 
are linearly independent and only two are solvable. 




Cl C2 C3 C4 C5 Cfi 



Fig. 10. = {A, B, C, D}, f^T (T) = 6, and e = 2. The combinations 
Cl, C2, and C3 are functions of A and B. The combinations C5 and eg are 
functions of C and D. Combination C4 is a function of A, B, C and D. The set 
Q = {ci, C2, C3, C4} has 3 linearly independent combinations, from which 
only two can be solved to recover A and B 

If each node v e F^ has f '"{T) paths to T that are link 
disjoint from the paths from all other nodes in F/p to T, 
network coding will not be necessary and each node in F^ 
can send P'{T) copies of its data on its f'"{T) paths to T. 
However, network coding becomes necessary if the paths from 
the nodes in F!p to T share links. The first Unks to be shared 
are in the link-cut between and T that is closest to F!j.. 

Let /^"^{T) = n, then there are n edge-disjoint paths 



{P{, . . . , f,' } from Ffp to T. Let C- denote the cutting edge on 
path Pi from a node in F/p to T that is closest to F^ (if path 
P/ has more than one cutting edge). Recall that is a cutting 
edge only if the maximum achievable F^-T flow is reduced 
by I. Let Z be the set of coding nodes, which contains the 
tail nodes of aU the n cutting edges as follows; 

n 

Note that \Z\ < n, and that network coding is not necessary 
at any of the downstream nodes after Z, since the combina- 
tions created at the nodes Z will be forwarded to T on \F^\ 
edge-disjoint paths. Let \F^\ — m, then a network code can 
be constructed by assigning each edge C^, where 1 < i < n, a 
distinct column from an m x n Cauchy matrix. The solvability 
of any m combinations depends on how the nodes in are 
connected to T as shown in the previous example. Specifically, 
let r be the minimum number of solvable combinations in any 
m combinations, and let q denote the number of failures in 
the post-cut portion of the graph. Then we are guaranteed the 
full recovery of the m data units if q = 1 (by Theorem 2), 
and we are guaranteed the partial recovery of at least r data 
units if q = e (by the definition of r). 

VIII. Conclusions 

We presented a new protection approach, called max-flow 
protection, which can enhance the survivability of the whole 
S-T max-flow. The basic idea is not to protect links in the min- 
cut, but try to protect all other links if possible. We divided 
the problem into two problems; pre-cut protection and post- 
cut protection. Pre-cut protection is NP-hard. Therefore, the 
problem is formulated as an ILP, and a heuristic is proposed 
to solve it. We showed that all data units that are not delivered 
directly to T after the min-cut can be post-cut-protected. 
Finally, simple network codes are proposed to maximize the 
number of pre- and post-cut protected paths. 
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